Casework: An Agentic Approach to Fraud Investigation
Investigating financial fraud is a complex, multi-stage process. It begins with a suspicious transaction, but the real challenge lies in systematically gathering evidence, identifying knowledge gaps, and justifying subsequent actions. To tackle this, a team developed Casework, an agentic fraud investigator that integrates disparate data sources and reasoning capabilities. Built for the TigerGraph × HHGoa challenge, Casework aims to provide a transparent and auditable trail for fraud investigations, making the entire process understandable to human reviewers.
The core problem Casework addresses is the difficulty in managing the evidence lifecycle in fraud detection. Traditional systems often struggle to connect seemingly unrelated pieces of information, leaving investigators to manually piece together a narrative. Casework's approach is to unify graph-based evidence, document retrieval, a localized language model, and predefined policy rules into a cohesive system. This allows for a case to be followed from its initial trigger all the way to a final, evidence-backed recommendation. The emphasis is on explainability: an analyst must be able to clearly see the rationale behind any recommended action, pinpoint missing information, and understand how the introduction of new evidence alters the investigation's trajectory.
Technical Architecture and Components
Casework's architecture is designed to harness the power of graph databases and large language models for sophisticated reasoning. At its heart is TigerGraph, a native parallel graph database. TigerGraph's ability to model complex relationships and perform high-speed queries is crucial for connecting entities involved in fraudulent activities, such as accounts, transactions, devices, and IP addresses. By representing these as nodes and edges in a graph, investigators can visualize and traverse intricate networks that might otherwise remain hidden.
Complementing the graph database is the concept of GraphRAG (Retrieval Augmented Generation). This technique combines retrieval mechanisms with generative AI. In Casework, when the agent needs to reason about a specific aspect of a case, it doesn't just rely on the LLM's general knowledge. Instead, it first retrieves relevant contextual information from the TigerGraph database—think of it as querying the graph for specific connections, transaction histories, or entity attributes. This retrieved information is then fed into the LLM along with the prompt. This grounded approach ensures that the LLM's responses and recommendations are based on factual, case-specific data, significantly reducing the risk of hallucination and improving the accuracy of fraud assessments.
The system also incorporates a local language model. This choice likely stems from a desire for greater control over data privacy and potentially lower operational costs compared to cloud-based LLM APIs. Running a local LLM means sensitive investigation data remains within the application's environment, enhancing security and compliance. The LLM acts as the central reasoning engine, processing retrieved graph data and document information to make deductions and formulate recommendations.
Furthermore, document retrieval is a key component. Fraud investigations often involve a wealth of unstructured data, such as police reports, internal compliance documents, customer communications, and regulatory guidelines. Casework integrates a system to search and retrieve relevant documents, which are then used to augment the LLM's understanding, similar to the RAG paradigm. Finally, policy rules are embedded to ensure that recommendations align with established organizational or regulatory frameworks. These rules act as guardrails, ensuring that the AI's outputs are not only data-driven but also compliant and actionable.
The Agentic Workflow
Casework operates as an agent, meaning it can autonomously perform a series of actions to progress an investigation. The process typically begins with an alert or a suspicious transaction. This trigger initiates the agent's workflow. The agent then queries the TigerGraph database to identify related entities and transactions, building a preliminary graph of the case. Simultaneously, it might search for relevant documents that could provide context or additional evidence.
The retrieved graph data and document snippets are then fed into the local LLM, which, guided by the GraphRAG approach, synthesizes this information. The LLM's task is to analyze the evidence, assess the risk, and potentially identify patterns indicative of fraud. This could involve identifying money laundering rings, synthetic identity fraud, or account takeovers.
Based on its analysis, the agent formulates a recommendation. This recommendation is not a black box. The system is designed to present the supporting evidence, the chain of reasoning, and any uncertainties or missing pieces of information. For instance, if a transaction involves an unusual IP address, the agent might recommend checking associated accounts or cross-referencing with known fraudulent IPs. If critical information is missing, the agent can flag it, prompting the human analyst to seek it out.
The inclusion of policy rules ensures that the recommendations are practical and compliant. For example, a rule might dictate that a certain threshold of evidence is required before freezing an account. The agent evaluates its findings against these rules before presenting a final recommendation. This closed-loop system, from trigger to recommendation, with auditable steps and clear reasoning, is what makes Casework a powerful tool for fraud investigation teams.
Implications and Future Directions
The development of Casework highlights a significant trend in AI application: the move towards agentic systems that can perform complex reasoning and actions autonomously, grounded in specific data. By integrating graph databases with LLMs through GraphRAG, Casework offers a blueprint for building more sophisticated and explainable AI systems for domains requiring deep analytical capabilities, such as finance, cybersecurity, and compliance.
The ability to visualize and audit the decision-making process is paramount in regulated industries like finance. Casework's emphasis on explainability means that human investigators can oversee the AI's work, intervene when necessary, and trust the recommendations made. This hybrid human-AI approach is likely to become the standard for high-stakes decision-making.
Looking ahead, the potential applications are vast. Casework could be extended to other forms of financial crime, such as insider trading or market manipulation. Further integration with real-time data streams could enable proactive fraud detection rather than reactive investigation. The use of local LLMs also opens avenues for more specialized, domain-specific models that can be fine-tuned for particular types of fraud, further enhancing accuracy and efficiency. The challenge remains in scaling these systems and ensuring their robustness against evolving fraud tactics.